CVE-2022-37454: Critical Buffer Overflow Vulnerability in Bitnami libphp
Summary
CVE-2022-37454: The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows attackers to execute arbitrary code or eliminate expected cryptographic properties. Affects libphp across 3 version ranges.
>= 7.2.0, < 7.4.33
>= 8.0.0, < 8.0.25
>= 8.1.0, < 8.1.12
Fixed in 7.4.33, 8.0.25 or 8.1.12, depending on the release line you run. How to fix ↓
Also tracked for
- pysha3 · PyPI
- libpython · Bitnami
- python-min · Bitnami
- php-min · Bitnami
- python · Bitnami
- php · Bitnami
- pysha3 · PyPI
- python3 · Alpine:v3.16
The same CVE-2022-37454 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Bitnami's libphp package provides a robust environment for running PHP applications, enabling developers to deploy and manage PHP applications seamlessly. It is widely used in various web applications due to its ease of use and integration capabilities. However, the package has been found to contain a critical vulnerability that can lead to severe security risks.
Vulnerability Detail
The vulnerability identified as CVE-2022-37454 arises from an integer overflow and subsequent buffer overflow in the Keccak XKCP SHA-3 reference implementation, specifically in the sponge function interface. This flaw allows attackers to execute arbitrary code or compromise the expected cryptographic properties of the application, posing a significant threat to data integrity and application security.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 7.2.0, < 7.4.337.4.33 -
>= 8.0.0, < 8.0.258.0.25 -
>= 8.1.0, < 8.1.128.1.12
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary measure, consider disabling the affected functionalities of the Keccak SHA-3 implementation until the package can be updated. However, this is not a long-term solution and should only be used if immediate patching is not feasible.
Conclusion
The CVE-2022-37454 vulnerability in Bitnami's libphp package poses a critical risk due to its potential for arbitrary code execution. It is crucial to update to the patched versions to mitigate this risk and ensure the security of your applications.
See every vulnerability recorded for libphp →
FAQ
CVE-2022-37454 is a critical vulnerability in the Bitnami libphp package that allows for buffer overflow and potential arbitrary code execution.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability can lead to arbitrary code execution, compromising the integrity and security of the application.
You can update the libphp package to a patched version using the provided commands for versions 7.4.33, 8.0.25, or 8.1.12.
If immediate updating is not possible, consider disabling the affected functionalities as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for libphp.
